Box Maze: A Three-Layer Process-Control Architecture for Safer LLM Reasoning

Forum topic · 小凯 · 2026-03-21

Summary

Box Maze is a proposed process-control architecture that improves the safety and reliability of large language model (LLM) reasoning by embedding safeguards during inference rather than relying solely on post-hoc filtering or RLHF training. The framework operates on three layers: Memory Grounding (anchoring claims to verifiable external sources with consistency checks and provenance), Structured Inference (enforcing step-by-step reasoning templates with intermediate verification and auditable reasoning paths), and Boundary Enforcement (hard-coded safety rules, continuous monitoring during generation, and rollback to earlier decision points when a reasoning path approaches a violation). In experiments across heterogeneous models including DeepSeek-V3, Doubao, and Qwen, the architecture reduced boundary failure rates from roughly 40% under baseline RLHF to below 1% across 50 adversarial scenarios simulating progressive boundary erosion, while preserving performance on normal tasks. Ablations showed each layer contributed independently. The approach represents inference-time architectural constraint as a third pillar of AI safety alongside training-time alignment and output filtering, offering immediacy, explainability, auditability, and composability—though open issues remain around compute overhead, flexibility trade-offs, evolving attacks, and the need for validation beyond simulated settings.

Introduction: When AI Hallucinates

The post opens with a real incident: in 2023, a lawyer submitted a court filing written with ChatGPT that cited more than a dozen entirely fabricated precedents, leading to professional discipline. This illustrates AI "hallucination"—confident but false output—and the related risk of prompt injection attacks, where crafted inputs trick models into bypassing safety limits. Existing safeguards like RLHF and output filtering act mostly *after* generation. Box Maze proposes a more fundamental approach: safety gates embedded within the reasoning process itself.

Background: Why LLMs Go Wrong

LLMs are next-token predictors, not true language understanders; outputs reflect statistical patterns from training data.
Hallucinations arise from noisy training data and context pressure (models tend to accommodate user requests even when the premise is false).
Adversarial prompting techniques include role-play attacks, indirect injection (hidden instructions in web pages the model reads), and gradual erosion (a series of seemingly harmless requests that progressively lower the model's guard).
Even strong RLHF-trained models reportedly show a 10–40% success rate for adversarial attacks.

The Box Maze Architecture: Three Layers

The name evokes confining AI reasoning within a "maze" of preset constraints:

1. Memory Grounding — Establish trusted information before reasoning begins: external knowledge retrieval, continuous memory-consistency checks, and source attribution for every key fact ("according to document X" rather than "I think..."). 2. Structured Inference — Force logically disciplined reasoning via reasoning templates (problem decomposition, causal chains, conditional branches), verification at every intermediate step, and complete reasoning-path logging for later audit. 3. Boundary Enforcement — A final firewall with hard-coded prohibitions that prompt injection cannot bypass, progressive boundary detection during generation, and rollback to earlier decision points when a path leads toward a violation (like backtracking out of a maze dead end).

The author offers an aviation analogy: Memory Grounding is like flight plans and live weather data, Structured Inference is like standard operating procedure checklists, and Boundary Enforcement is like ground-proximity warnings and auto-collision avoidance—hardware-level guarantees rather than pilot training alone. The design also parallels the human cognitive architecture of perception, working memory, and executive control.

Key points

Experimental setup: 50 adversarial scenarios simulating "progressive boundary erosion" (incrementally steering the model across safety lines), tested across heterogeneous LLMs: DeepSeek-V3, Doubao, and Qwen.
Headline result: boundary failure rate dropped from ~40% (baseline RLHF) to <1% (Box Maze)—a greater than 40x improvement.
Ablation study: Memory Grounding alone reduced failures to ~15%; adding Structured Inference brought it to ~5%; all three layers achieved <1%, showing each layer's independent value.
Cross-model consistency: results held across all tested architectures, suggesting a general architectural improvement rather than a model-specific trick.
No performance penalty: performance on regular (non-adversarial) tasks remained essentially unchanged.
Why it beats RLHF: RLHF relies on the model's "self-discipline," while Box Maze provides architectural, hard constraints—process control versus behavior training.

Significance and Outlook

Box Maze exemplifies process-level control: a third path for AI safety beyond training-time alignment (RLHF) and post-generation output filtering. Advantages include:

Immediate effect without retraining
Explainable, auditable step-by-step decisions
Composability with existing RLHF and filtering methods

Limitations

Higher computational overhead may bottleneck real-time applications
Excessive constraints may limit creativity; safety-vs-flexibility balance is unresolved
Attackers may develop counter-strategies targeting the architecture itself
Current experiments are simulation-based; real-world validation is still needed

Conclusion

The post argues that making AI reliable requires not just smarter models but rigorous "institutional design." Just as human societies rely on law, audit, and checks-and-balances, AI systems need internal process control. The three layers—memory grounding, structured inference, boundary enforcement—offer a concrete blueprint, reframing AI safety as an architecture problem, not merely a training problem.

Reference paper: Zou, Q. (2026). Box Maze: A Process-Control Architecture for Reliable LLM Reasoning. arXiv:2603.19182.

Related reading:

Chain-of-Thought Prompting: https://arxiv.org/abs/2201.11903
RLHF: https://arxiv.org/abs/2203.02155
Prompt Injection: https://simonwillison.net/2022/Sep/12/prompt-injection/